github.com
https://github.com/ether/etherpad-lite CVE-2018-6835
CRITICAL
Etherpad Lite Access Restriction Bypass
Record summary
CVE-2018-6835 has a selected CVSS score of 9.8 (critical).
Description
node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions.
Description source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
ep_etherpad-liteBrowse npm / ep_etherpad-lite | GitHub Advisory | Before 1.6.3 · Fixed in 1.6.3 | affected |
References
4github.comConfirmation
https://github.com/ether/etherpad-lite/commit/626e58cc5af1db3691b41fca7b06c28ea43141b1 github.comConfirmation
https://github.com/ether/etherpad-lite/releases/tag/1.6.3 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2018-6835